cvs: import patches from Gentoo

While we are at it, fix build with newer gcc

srcpkgs/cvs/patches/CVE-2012-0804.patch

@@ -0,0 +1,25 @@
+[CVE-2012-0804] Fix proxy response parser
+
+If proxy sends overlong HTTP vesion string, the string will be copied
+to unallocatd space (write_buf) causing heap overflow.
+
+This patch fixes it by ignoring the HTTP version string and checking
+the response line has been parsed correctly.
+
+See <https://bugzilla.redhat.com/show_bug.cgi?id=773699> for more
+details.
+
+--- a/src/client.c
++++ b/src/client.c
+@@ -3558,9 +3558,9 @@ connect_to_pserver (cvsroot_t *root, str
+          * code.
+          */
+ 	read_line_via (from_server, to_server, &read_buf);
+-	sscanf (read_buf, "%s %d", write_buf, &codenum);
++	count = sscanf (read_buf, "%*s %d", &codenum);
+ 
+-	if ((codenum / 100) != 2)
++	if (count != 1 || (codenum / 100) != 2)
+ 	    error (1, 0, "proxy server %s:%d does not support http tunnelling",
+ 		   root->proxy_hostname, proxy_port_number);
+ 	free (read_buf);

srcpkgs/cvs/patches/autoconf.patch

@@ -0,0 +1,107 @@
+--- a/configure.in
++++ b/configure.in
+@@ -33,6 +33,15 @@ gl_EARLY
+ AC_PROG_CC
+ AM_PROG_CC_C_O
+ 
++AC_TYPE_LONG_LONG_INT
++
++if test "$ac_cv_type_long_long_int" = yes; then
++  ac_cv_type_long_long=yes
++  AC_DEFINE(HAVE_LONG_LONG, 1, [Define if you have the 'long long' type.])
++else
++  ac_cv_type_long_long=no
++fi
++
+ # Find the posix library needed on INTERACTIVE UNIX (ISC)
+ dnl
+ dnl From the Autoconf 2.53 manual (AC_ISC_POSIX):
+@@ -150,7 +159,7 @@ AM_CONDITIONAL(MAKE_TARGETS_IN_VPATH, \
+ 		|| test $srcdir = .)
+ 
+ AC_HEADER_DIRENT
+-AC_HEADER_STDC
++AC_DEFINE(STDC_HEADERS, 1, "stdc headers")
+ AC_HEADER_SYS_WAIT
+ AC_CHECK_HEADERS(\
+ 	direct.h \
+@@ -180,6 +189,7 @@ AC_CHECK_MEMBERS([struct stat.st_blksize
+ AC_CHECK_MEMBERS([struct stat.st_rdev])
+ 
+ AC_FUNC_FSEEKO
++AC_CHECK_FUNCS(fseeko)
+ if test $ac_cv_func_fseeko = no; then
+     AC_LIBOBJ(fseeko)
+     AC_LIBOBJ(ftello)
+@@ -207,7 +217,7 @@ gl_INIT
+ dnl For one reason or another, the autogenerated m4/gnulib.m4 wants
+ dnl AM_GNU_GETTEXT([external]) called directly from here.
+ AM_GNU_GETTEXT([external])
+-AM_GNU_GETTEXT_VERSION dnl work around for autoconf-2.57 bug.
++AM_GNU_GETTEXT_VERSION(0.19.8) dnl work around for autoconf-2.57 bug.
+ # The error module still poses merge problems.
+ AC_FUNC_STRERROR_R
+ dnl The following macros can be called by other GNULIB macros but are also
+@@ -220,8 +230,8 @@ AC_REQUIRE([gt_TYPE_WCHAR_T])
+ AC_REQUIRE([gt_TYPE_WINT_T])
+ AC_REQUIRE([gl_AC_TYPE_INTMAX_T])
+ AC_REQUIRE([gl_FUNC_MMAP_ANON])
+-AC_REQUIRE([gl_AC_TYPE_LONG_LONG])])
++])
+ CCVS_CALL_GNULIB_MACROS_ONCE()
+ dnl Until I persuade the GNULIB folks to integrate this module.
+ gl_GLOB
+ 
+--- a/m4/allocsa.m4
++++ b/m4/allocsa.m4
+@@ -10,6 +10,5 @@ AC_DEFUN([gl_ALLOCSA],
+   dnl @ALLOCA@ and @LTALLOCA@.
+   AC_REQUIRE([gl_FUNC_ALLOCA])
+   AC_REQUIRE([gl_EEMALLOC])
+-  AC_REQUIRE([gl_AC_TYPE_LONG_LONG])
+   AC_REQUIRE([gt_TYPE_LONGDOUBLE])
+ ])
+--- a/m4/intmax_t.m4
++++ b/m4/intmax_t.m4
+@@ -18,7 +18,6 @@ AC_DEFUN([gl_AC_TYPE_INTMAX_T],
+   AC_REQUIRE([gl_AC_HEADER_INTTYPES_H])
+   AC_REQUIRE([gl_AC_HEADER_STDINT_H])
+   if test $gl_cv_header_inttypes_h = no && test $gl_cv_header_stdint_h = no; then
+-    AC_REQUIRE([gl_AC_TYPE_LONG_LONG])
+     test $ac_cv_type_long_long = yes \
+       && ac_type='long long' \
+       || ac_type='long'
+@@ -51,7 +50,6 @@ AC_DEFUN([gt_AC_TYPE_INTMAX_T],
+     AC_DEFINE(HAVE_INTMAX_T, 1,
+       [Define if you have the 'intmax_t' type in <stdint.h> or <inttypes.h>.])
+   else
+-    AC_REQUIRE([gl_AC_TYPE_LONG_LONG])
+     test $ac_cv_type_long_long = yes \
+       && ac_type='long long' \
+       || ac_type='long'
+--- a/m4/vasnprintf.m4
++++ b/m4/vasnprintf.m4
+@@ -23,7 +23,6 @@ AC_DEFUN([gl_FUNC_VASNPRINTF],
+ AC_DEFUN([gl_PREREQ_PRINTF_ARGS],
+ [
+   AC_REQUIRE([bh_C_SIGNED])
+-  AC_REQUIRE([gl_AC_TYPE_LONG_LONG])
+   AC_REQUIRE([gt_TYPE_LONGDOUBLE])
+   AC_REQUIRE([gt_TYPE_WCHAR_T])
+   AC_REQUIRE([gt_TYPE_WINT_T])
+@@ -32,7 +31,6 @@ AC_DEFUN([gl_PREREQ_PRINTF_ARGS],
+ # Prequisites of lib/printf-parse.h, lib/printf-parse.c.
+ AC_DEFUN([gl_PREREQ_PRINTF_PARSE],
+ [
+-  AC_REQUIRE([gl_AC_TYPE_LONG_LONG])
+   AC_REQUIRE([gt_TYPE_LONGDOUBLE])
+   AC_REQUIRE([gt_TYPE_WCHAR_T])
+   AC_REQUIRE([gt_TYPE_WINT_T])
+@@ -45,7 +43,6 @@ AC_DEFUN([gl_PREREQ_PRINTF_PARSE],
+ AC_DEFUN([gl_PREREQ_VASNPRINTF],
+ [
+   AC_REQUIRE([AC_FUNC_ALLOCA])
+-  AC_REQUIRE([gl_AC_TYPE_LONG_LONG])
+   AC_REQUIRE([gt_TYPE_LONGDOUBLE])
+   AC_REQUIRE([gt_TYPE_WCHAR_T])
+   AC_REQUIRE([gt_TYPE_WINT_T])

srcpkgs/cvs/patches/no-krb.patch

@@ -0,0 +1,72 @@
+--- a/configure.in
++++ b/configure.in
+@@ -563,69 +563,6 @@ AC_MSG_RESULT([])
+ AC_SUBST(KRB4)])dnl
+ WITH_KRB4
+ 
+-krb_h=
+-AC_MSG_CHECKING([for krb.h])
+-if test "$cross_compiling" != yes && test -r $KRB4/include/krb.h; then
+-   hold_cflags=$CFLAGS
+-   CFLAGS="$CFLAGS -I$KRB4/include"
+-   AC_TRY_LINK([#include <krb.h>],[int i;],
+-          [krb_h=yes krb_incdir=$KRB4/include],
+-          [CFLAGS=$hold_cflags
+-           AC_TRY_LINK([#include <krb.h>],[int i;],
+-             [krb_h=yes krb_incdir=])])
+-   CFLAGS=$hold_cflags
+-else
+-   AC_TRY_LINK([#include <krb.h>],[int i;],
+-             [krb_h=yes krb_incdir=])
+-fi
+-if test -z "$krb_h"; then
+-  AC_TRY_LINK([#include <krb.h>],[int i;],
+-    [krb_h=yes krb_incdir=],
+-    [if test "$cross_compiling" != yes && test -r $KRB4/include/kerberosIV/krb.h; then
+-       hold_cflags=$CFLAGS
+-       CFLAGS="$CFLAGS -I$KRB4/include/kerberosIV"
+-       AC_TRY_LINK([#include <krb.h>],[int i;],
+-	 [krb_h=yes krb_incdir=$KRB4/include/kerberosIV])
+-       CFLAGS=$hold_cflags
+-     fi])
+-fi
+-AC_MSG_RESULT($krb_h)
+-
+-if test -n "$krb_h"; then
+-  krb_lib=
+-  if test "$cross_compiling" != yes && test -r $KRB4/lib/libkrb.a; then
+-       hold_ldflags=$LDFLAGS
+-       LDFLAGS="-L${KRB4}/lib $LDFLAGS"
+-       AC_CHECK_LIB(krb,printf,[krb_lib=yes krb_libdir=${KRB4}/lib],
+-           [LDFLAGS=$hold_ldflags
+-            # Using open here instead of printf so we don't
+-            # get confused by the cached value for printf from above.
+-            AC_CHECK_LIB(krb,open,[krb_lib=yes krb_libdir=])])
+-       LDFLAGS=$hold_ldflags
+-  else
+-       AC_CHECK_LIB(krb,printf,[krb_lib=yes krb_libdir=])
+-       AC_CHECK_FUNC(krb_recvauth,[krb_lib=yes krb_libdir=])
+-  fi
+-  if test -n "$krb_lib"; then
+-    AC_DEFINE([HAVE_KERBEROS], 1,
+-	      [Define if you have MIT Kerberos version 4 available.])
+-    cvs_client_objects="$cvs_client_objects kerberos4-client.o"
+-    test -n "${krb_libdir}" && LIBS="${LIBS} -L${krb_libdir}"
+-    # Put -L${krb_libdir} in LDFLAGS temporarily so that it appears before
+-    # -ldes in the command line.  Don't do it permanently so that we honor
+-    # the user's setting for LDFLAGS
+-    hold_ldflags=$LDFLAGS
+-    test -n "${krb_libdir}" && LDFLAGS="$LDFLAGS -L${krb_libdir}"
+-    AC_CHECK_LIB(des,printf,[LIBS="${LIBS} -ldes"])
+-    AC_CHECK_LIB(krb,krb_recvauth)
+-    AC_CHECK_LIB(krb4,krb_recvauth)
+-    LDFLAGS=$hold_ldflags
+-    if test -n "$krb_incdir"; then
+-      CPPFLAGS="$CPPFLAGS -I$krb_incdir"
+-    fi
+-  fi
+-fi
+-AC_CHECK_FUNCS(krb_get_err_text)
+ 
+ 
+ dnl

srcpkgs/cvs/patches/openat.patch

@@ -0,0 +1,19 @@
+--- a/lib/openat.c
++++ b/lib/openat.c
+@@ -57,9 +57,13 @@ rpl_openat (int fd, char const *file, in
+       va_list arg;
+       va_start (arg, flags);
+ 
+-      /* Assume that mode_t is passed compatibly with mode_t's type
+-	 after argument promotion.  */
+-      mode = va_arg (arg, mode_t);
++      /* If mode_t is narrower than int, use the promoted type (int),
++         not mode_t.  Use sizeof to guess whether mode_t is nerrower;
++         we don't know of any practical counterexamples.  */
++      if (sizeof (mode_t) < sizeof (int))
++	mode = va_arg (arg, int);
++      else
++	mode = va_arg (arg, mode_t);
+ 
+       va_end (arg);
+     }

srcpkgs/cvs/patches/ssh.patch

@@ -1,9 +1,9 @@
 Fix for CVE-2017-12836, extracted from MirBSD repository.
 
---- a/src/rsh-client.c	2017/03/26 15:54:10	1.6
+--- a/src/rsh-client.c
-+++ b/src/rsh-client.c	2017/08/11 20:41:40	1.7
++++ b/src/rsh-client.c
-@@ -107,6 +108,9 @@ start_rsh_server (cvsroot_t *root, struc
+@@ -97,6 +97,9 @@ start_rsh_server (cvsroot_t *root, struc
- 	rsh_argv[i++] = argvport;
+ 	rsh_argv[i++] = root->username;
      }
  
 +    /* Only non-option arguments from here. (CVE-2017-12836) */
@@ -11,13 +11,13 @@ Fix for CVE-2017-12836, extracted from MirBSD repository.
 +
      rsh_argv[i++] = root->hostname;
      rsh_argv[i++] = cvs_server;
-     if (readonlyfs)
+     rsh_argv[i++] = "server";
-@@ -190,6 +194,8 @@ start_rsh_server (cvsroot_t *root, struc
+@@ -171,6 +174,8 @@ start_rsh_server (cvsroot_t *root, struc
- 		*p++ = "-p";
+ 	    *p++ = root->username;
- 		*p++ = argvport;
  	}
-+
-+	*p++ = "--";
  
++	*p++ = "--";
++
  	*p++ = root->hostname;
  	*p++ = command;
+ 	*p++ = NULL;

srcpkgs/cvs/template

@@ -1,20 +1,27 @@
 # Template file for 'cvs'
 pkgname=cvs
 version=1.12.13
-revision=7
+revision=8
 build_style=gnu-configure
 configure_args="--with-editor=/usr/bin/vi --with-external-zlib
  ac_cv_func_working_mktime=yes"  # broken test upstream
-hostmakedepends="nvi openssh"
+hostmakedepends="nvi openssh automake libtool gettext-devel-tools"
 makedepends="mit-krb5-devel openssh"
 depends="openssh>=6.1p1"
 short_desc="Concurrent Versions System"
 maintainer="Orphaned <orphan@voidlinux.org>"
 homepage="http://www.nongnu.org/cvs/"
-license="GPL-1, LGPL-2"
+license="GPL-1.0-or-later, LGPL-2.0-or-later"
 distfiles="http://ftp.gnu.org/non-gnu/cvs/source/feature/$version/cvs-$version.tar.bz2"
 checksum=78853613b9a6873a30e1cc2417f738c330e75f887afdaf7b3d0800cb19ca515e
 
 if [ "$XBPS_TARGET_LIBC" = "glibc" ]; then
 	makedepends+=" libxcrypt-devel"
 fi
+CFLAGS="-D_GNU_SOURCE=1"
+
+pre_configure() {
+	cp configure.in configure.ac
+	autoupdate
+	autoreconf -fi
+}